Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25/12/2023, 02:35
General
-
Target
004749773756ce13d85d9598d4a73f0b.exe
-
Size
162KB
-
MD5
004749773756ce13d85d9598d4a73f0b
-
SHA1
afaa638180888267c366a50c3d8ac25a4e9cc18b
-
SHA256
6b2ea054c7f6e247167c0780c48ae52f8c95eb9c82f52f929bb31582e9b5a32c
-
SHA512
4a823e8eff33f2c7ba9b0eeef56fb73d0dfe700fcec922da04ae0c1f431749a112bd936032a429dab0344b0ce7826edb9d6ad63070f07557f576572891a943ce
-
SSDEEP
3072:fOIuHiSWoHMevkxo6v/Ff2Apx9A00rVPcPEcASBqStal:mPCeMev6nFjp4PrVPvDSBqj
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Registers COM server for autorun 1 TTPs 3 IoCs
-
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\004749773756ce13d85d9598d4a73f0b.exe"C:\Users\Admin\AppData\Local\Temp\004749773756ce13d85d9598d4a73f0b.exe"2⤵
- Registers COM server for autorun
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5bfa0c9ec67cd0f1b2dabfc7777aae294
SHA1c15a4686bda91546e4c3abba58530423c40da3dc
SHA256f3a8ac1721abb9068c5c281dafeaebdf3a66f96954c9e882ef71dee9c44bc585
SHA512e2e7b989e17dcf2f0c2b93e53671a6f34230b31b0daa152fd9ec84aa14055b1350960d5dbc7da02a03d4eda7c68f9082f6c8be053ec56c0bed5b2bd0ef38556f
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
4KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
4KB